#112 · Admin security findings dashboard + public stats page

Context

Admins reviewing security findings can approve them via /admin's award request queue, but there's no transparency view showing how many findings have been accepted by tier, who's earned them, or aggregate program activity. This makes it hard to (a) communicate program traction to the community, (b) spot patterns (e.g., 5 SQLi findings in one week → systemic), (c) recognize top contributors publicly.

Acceptance criteria

• [ ] New /admin/security route (admin-only) showing:
• Counts of approved findings by tier (low/medium/high/critical/rce) over all-time, last 30 days, last 7 days
• Top 10 reporters (by total security points earned, opt-out respected via leaderboard_visible)
• Recent findings table: date, tier, reporter, brief title, status
• Total points awarded via the security program
• [ ] Public-friendly version at /security/stats (no admin auth) showing only the aggregate counts and the all-time leaderboard (no titles or reporter detail beyond display_name)
• [ ] Nav link added to admin dropdown
• [ ] Numbers query the point_events table directly with WHERE action LIKE 'security_%' AND revoked_at IS NULL

Technical hints

• Add as a new template apps/scoreboard/src/templates/security-stats.ts
• Time-windowed aggregations: WHERE created_at >= datetime('now', '-30 days')
• Reuse bounty-stat CSS classes from /bounties for the count cards
• Don't duplicate the leaderboard logic — reuse getLeaderboard with a new period filter? Or just build a simple SUM query gated by action prefix. Simpler is better here.

Why now

• 11 security bounty issues just landed (#101-#111)
• We need a way to surface program traction so contributors see it's worth their time
• Public stats build trust ("they actually pay out")

--- *Submit a merge request that says Closes #<this iid> in the description. On merge to main, the GitLab webhook auto-awards your bounty (S tier, 50 pts) + the standard merge_pr (40 pts) to your scoreboard account.*